From 5cbb7a316b9c0d530f2d64f98946ce064d075857 Mon Sep 17 00:00:00 2001 From: Gagan Grover Date: Tue, 22 Nov 2016 15:01:11 +0530 Subject: video: tegra: nvmap: fix possible use after free Fix possible use after free issue. Bug 1814555 Bug 1884319 Change-Id: I826aa34f61d43fda5419a528697ce84ba2ce1eae Reviewed-on: http://git-master/r/1221643 Signed-off-by: Gagan Grover Signed-off-by: Debarshi Dutta Reviewed-on: http://git-master/r/1257999 (cherry picked from commit b1647da33cff0c498ca8439a722ea1962ecf6901 in rel-24) Reviewed-on: http://git-master/r/1461184 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- drivers/video/tegra/nvmap/nvmap_ioctl.c | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) (limited to 'drivers/video/tegra') diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index 7e59d245069f..27db8f6799af 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -309,24 +309,6 @@ int nvmap_ioctl_alloc_kind(struct file *filp, void __user *arg) return err; } -int nvmap_create_fd(struct nvmap_client *client, struct nvmap_handle *h) -{ - int fd; - - fd = __nvmap_dmabuf_fd(client, h->dmabuf, O_CLOEXEC); - BUG_ON(fd == 0); - if (fd < 0) { - pr_err("Out of file descriptors"); - return fd; - } - /* __nvmap_dmabuf_fd() associates fd with dma_buf->file *. - * fd close drops one ref count on dmabuf->file *. - * to balance ref count, ref count dma_buf. - */ - get_dma_buf(h->dmabuf); - return fd; -} - int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) { struct nvmap_create_handle op; @@ -354,7 +336,7 @@ int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) if (IS_ERR(ref)) return PTR_ERR(ref); - fd = nvmap_create_fd(client, ref->handle); + fd = nvmap_get_dmabuf_fd(client, ref->handle); if (fd < 0) err = fd; -- cgit v1.2.3